I was trying to exploit a buffer overflow in the following manner:
NOP sled -> shellcode -> address of NOP sled (before it was save RIP)
But, I was told on Stack Overflow that I should also append a NOP sled to my shellcode:
NOP sled -> shellcode ->address of NOP sled -> NOP sled.
Can anyone explain to me why should I append a NOP sled to my shellcode?
This is my original post on Stack Overflow:
EDIT: I read another post in which someone had the same problem.
He fixed this by adding a small NOP sled after the shellcode. Since the shellcode was added to the stack at the end of the buffer, and it pushes some things to the stack itself, it was overwriting its own code.
But I don't understand how a push instruction can make the shellcode overwrite its own code.